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/. Introduction 



Already in this decade, many colleges and universities have faced the difficult, challenges of 
cutbacks-including layoffs, loss of grants, spending freezes, and budget reductions. Managing change 
within this environment raises new concerns in higher education administration. Lately, many 
institutions have been asking themselves, "When we respond to these economic pressures and 
implement streamlined processes, how do we ensure that we haven't cut back too far, particularly in 
areas v/ith high financial risk?" In fact, many institutions are faced with balancing controls against 
costs-a challenge that requires finesse and dexterity. 

This monograph addresses the issue of maintaining adequate controls within a streamlined or 
restructured financial affairs environment. Cost-Effective Control Systems presents a new paradigm 
for control structures that will more effectively meet administrators' needs-both in terms of cost and 
risk management. Before building a new model for control, the authors first lay the foundation by: 

■ describing the principles of streamlining; 

■ examining the defmilion of control and its interpretation in practice; 

■ suggesting a new interpretation; and then 

■ outlining several examples of institutions currently redefining their operations under these 
principles. 



The Growth of Administrative Streamlining 

Many institution adnunistrators are studying the issue of administrative productivity by 
analyzing their current operations, reconsidering the business and processes in which they are engaged, 
and redesigning administrative functions to meet client service needs more efficiently and effectively. 
("Client" here and throughout the paper refers to any person who receives service from an administra- 
tive process; the same definition applies to the term "customer.") This process may be simply stated 
as administrative streamlining. Administrative streamlining/restructuring efforts, such as Just-in-Time 
(JIT) and Total Quality Management (TQM), share several fundamental, common steps. Figure 1 
illustrates these steps, which ai'e also described below.' 

1 ) After management identifier an area or process for attention, an employee "improvement 
team" works together to create and understand a baseline of the current situation. To create 
this "as-is" picture, the team first defines the process (inputs, outputs, performance 
chaiacteristics) and then gathers quantitative data to measure the current performance of 
the system. Tliis baseline serves two purposes: first, utilizing hard data, it objectively 
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highlights problem areas; second, it provides a standard against which future progress can 
be measured. 

2) The employee team then goes back to basics in a planning phase to determine what their 
clients really need and expect from the selected area or process. The purpose of this phase 
is to align the outputs of related processes with the expectations of both internal and external 
customers (an internal customer might be another university department or staff member, 
while external customers might include prospective students, the public, or granting 
agencies). The critical first step in this phase is defining "where you want to go"-dev eloping, 
in concert with management, a strategic vision. Customer needs and expectations provide 
the foundation for the vision. Once quality service is defined from the client's perspective, 
the gaps between the current processes and the client needs are evaluated. Using techniques 
such as brainstorming, the team seeks to identify all potential causes of unsatisfactory 
variation, or other failures of the process. Next, the team develops potential solutions. The 
team works to redesign functions to achieve the strategic vision, ultimately meeting 
customer service needs more effectively and efficiently. A written plan may be useful at this 
stage, including estimated costs and benefits of the solutions, as well as schedules, budgets, 
and other supporting information. 

3) Once the plan is complete, management selects a "pilot" area for a trial implementation. 
The progress of the implementation is tracked against the same measurements used to 
establish the baseline. Future plans for other areas of implementation are adjusted according 
to the pilot implementation. Improvement efforts can then move out to othicr areas of the 
organization, and the cycle repeats, witli efforts being linked to each other and to the 
strategic vision. 

4) TQM, as well as many other management programs, emphasizes continuous improve- 
ment to realize long-term change. The goal is to positively change institutional culture and 
to foster new attitudes about employee roles, responsibilities, and quality so that improve- 
ment and change become the norm. 

The phases described above lead to change that is implemented by the employees who are 
responsible for-and knowledgeable about-the work affected. This is in notable contrast to the 
autocratically mandated management style of old. Reengineering helps to establish better management 
processes with integrated controls, enabling upper management to better run their **business" and move 
closer to achieving the institution's strategic objectives. The resulting improvements truly meet both 
the institution's and the customers' needs. The overall strategy is to improve on an ongoing basis by 
giving the employees the analytical tools they need to continually reevaluate their work processes. 

Many institutions of higher education are actively working on productivity issues and have 
adopted variations of these management improvement strategies. Responding to the current environ- 
ment, colleges and universities are seeking to improve quality and service while simultaneously 
reducing costs; these institutions are further spurred on by others that have achieved substantial resuhs. 
A few publicly discussed streamlining initiatives follow. 

Boston College 

This college has developed a system that measures the unit costs and work How of intemal 
departments through the use of standardized reports. Axcording to Eileen M. Gaffney, writing in 
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Planning for Higher Education, "These studies, commissioned by the university's board of trustees, 
arose out of a concern that Boston College seek the most p roductive use of its monetary and staffing 
resources in both academic and administrative en vironments. Tney are conducted by a financial analyst 
who reports directly to the executive vice president of the university and involve considerable 
interaction with the chairperson/director of the area under review." 

University of Michigan 

A task force at U. of M. is studying quality in an era of resource constraints. The university 
seeks to "restrain unnecessary growth of costs and redirect expenditures from areas of low priority to 
those of higher priority." 

Columbia University 

Columbia has created the Office of Internal Management Services (IMS). According to the 
University, the purpose of IMS is to assist "departments in improving their operations, systems and 
procedures," and has a number of time- and money-saving accomplishments. For instance, IMS 
developed a microcomputer and peripheral equipment maintenance program that improves ser\ace 
while simultaneously reducing expenditures through the centralization of maintenance via an on-site 
service firm. The benefits of the program include faster response time, centralized service and billing, 
on-site storage of parts, increased staff productivity due to shorter machine downtime, and rental 
income and annual savings of nearly $125,000.- 

Oregon State University 

Faced with major challenges including dissatisfied customers, a lack of resources, and low 
employee morale, Oregon State decided to investigate whether or not a quality management system 
might improve the situation. The physical plant department served as the pilot implementation area, 
with the goal of "decreasing tumaround time in the remodelling process." Solutions implemented 
through TQM changed the basic structure of the department and shortened the targeted process by 10 
percent, a percentage that continues to increase. Success was achieved through the establishment of a 
customer service center, the creation of the position of project manager, and the adoption of various 
time-saving methods.^ 

Boston University 

This university recently undertook a study aimed at improving student service quality. The task 
force began by conducting focus sessions with B.U.'s student population. Based on feedback, 
individual task groups have decided to meet customer expectations by simplifying the registration 
process, shortening the tumaround time on financial aid information and loan processing, and more 
effectively communicating information on available services. These focus sessions will help the 
university respond to student and institutional needs by streamlining the bureaucratic interaction 
between administration and students."' 

The observation that Total Quality Management initiatives are becoming more widespread in 
the education industry isfurther demonstrated by the results of an informal survey conducted by Oregon 
State University and summarized in figure 2. This anecdotal evidence provides ample proof of the 
growing awareness of streamlining and cost reduction opportunities. Ii also leads back to the central 
concem of this monograph: As institution managers aggressively redesign administrative functions, 
they must necessarily address the issue of controls over finance and other operations. Will the 
redesigned and streamlined functions contain adequate controls? And will the institution, after 
restructuring or streamlining, '*pass muster" in the annual financial audit? 
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To properly answer these questions, one must examine where the controls came from in the first 
place. People don't plan systems to be inherently inefficient without compelling motives. Historically, 
pressures from situation-specific problems, regulations, regulators, and auditors resulted in increasing 
controls, particularly in financial areas. Recently, several highly publicized allegations and proven 
cases of fraud have created even more pressure on institutions to increase controls. Responding to these 
pressures, institutions have "layered on" controls-including excessive approvals, duplicate data 
storage, or the over-division of labor-to provide fail-safe assurance that university policies and 
procedures are followed to the letter. To correct these situations of expensive administration, many 
streamlining efforts focus on reducing or eliminating components of these fail-safe control systems. 
Once these back-up steps and controls are eliminated in the name of faster, more cost-effective 
processing, an institution must ensure that it has not exposed itself to unintended risks. At first glance, 
thedecision to streamline controls runs counter to the direction that institutions, auditors, and regulators 
have moved in the past decade. 

These two goals, streamlining and controlling, must be reconciled in order to meet the demands 
of modem business. Universities and colleges can no longer afford expensive administrative systems. 
At the same time, however, controlling operations and ensuring consistent, accurate delivery of service 
are still **musts" for effective administration. Therefore, a new paradigm must emerge. New control 
systems need to be designed to operate effectively in the streamlined business environment, and to 
provide administrators with the information and integrated controls they need to better manage the 
institution. 

The challenge addressed in this monograph is to create control systems that appropriately 
assure the accuracy and integrity of financially related transactions and records without either unduly 
interfering with the work performed or costing more to administer than the benefits derived. Although 
the theoretical discussion and examples from implementation largely focus on f nancially related 
controls, the concepts and the resulting model may be applied equally to compliance or operational 
controls. The authors analyze the issue of capable and consistent control systems in the remaining five 
sections as follows: 

■ Section II explains commonly used, traditional financial control systems and their frequent 
mutation into bureaucratic nightmares of dubious efficiency or effectiveness. 

■Section III looks at a theoretical framework for control systems that emphasizes 
controlling risk instead of controlling process flows or information. 

■ Section IV explores the application of this framework to a number of university processes 
and considers the implications of the suggested control structures on effectiveness, cost, and 
process management. 

■ Section V defines critical success factors and develops guidelines for implementing 
streamlined, risk-sensitive control structures. 

■ Section VI concludes the monograph and emphasizes key ideas. 



//. Traditional Control 
Structures 



The traditional purpose of an internal control structure is to reduce the institution's unintended 
exposure to business, financial, and accounting risks.^ Institutions, like all businesses, face a variety 
of hazards. These includ : 

■ Business risks — such as the demand for, or profitability of, a new academic program; or 
the risk inherent in building a new research center, the cost of which is to be offset by indirect 
cost recovery on research grants not yet obtained or not guaranteed into the future. 

■ Financial risks — such as vesting an individual with the authority to sign checks or the 
management of cash receipts. 

■ Accounting risks — such as the risk that miscategorized expenses could be significant 
enough to materially distort financial statements and skew decisions made from them, or the 
risk that categorization errors could result in the inclusion of inappropriate expenditures in 
overhead cost pools for indirect cost recovery. 

Looking at the purpose of controls from a different angle, the American Institute of Certified 
Public Accountants (AICPA) defines intemal control (in its Statement of Auditing Standards No. 55) 
as *'the policies and procedures established to provide reasonable assurance that specific entity 
objectives will be met." 

This definition focuses the user positively on the outcomes of an equity's endeavors. The 
previous definition concentrated on the management of the factors that create or enhance the risk of not 
achieving business, financial, and accounting objectives. The two interpretations are closely linked, 
however, because managing the risks of not achieving institutional objectives provides reasonable 
assurance, to institutional constituencies, that entity objectives will be met. To further tighten the bond 
between the two, if the institution does not effectively manage the risk that objectives will not be met, 
there can be no reasonable assurance that objectives will be met. 

It is important to understand from the outset thai the intemal control structure cannot protect 
the enterprise from all risks; reasonable assurance that objectives will be met does not constitute a 
blanket guarantee of success. Rather, the intemal control structure allows the enterprise to manage the 
level of exposure to unintended risks. For example, the intended risks to which an institution might 
expose itself could include the business risk of undertaking a new program or building a new research 
facility . As a second example, an institution's administrators might realistically accept the financial risk 
of small losses in cash receipts for the reason that full protection against these losses would be 
prohibitively expensive. However, if an institution's managers did not consider the risks inherent in a 
particular function (e.g., check signing) and hence did not control for the risk (by allowing the check 
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signer access to blank checks and making that person also responsible for bank reconciliations), then 
the institution is exposed to the unintended risk of the misappropriation of fiinds. 

Traditionally, financial control structures for financial affairs areas have been organized 
around three elements: the control environment, the accounting system, and the control procedures. 



The Control Environment 

The control environment is defined as the attitudes, abilities, and actions of personnel 
(especially at the management level) as they affect the overall operation and control of the college or 
university. 

The control environment represents the collective impact of various factors on the effectiveness 
of specific policies and procedures. Factors that affect the control environment typically include 
management philosophy or style, actions by the board of trustees, organizational structure, methods 
of assigning authority and responsibility, personnel policies, and the control methods used to monitor 
performance. In addition, appropriate involvement of the audit committee or the internal audit 
department can contribute to a healthy control environment. In short, the control environment is "the 
tone at the top" and can significantly influence the maintenance of effective accounting systems and 
control procedures. 



The Accounting System 

The accounting system includes the procedures established to identify, classify, record, and 
analyze an institution's transactions, as well as the documents produced as aresultof those procedures. 

The overall accounting system can consist of manual and/or computerized components. 
Specific criteria for an effective accounting system are outlined in figure 3. In general, the procedures 
and documents help management operate the college or university more effectively by providing 
accurate and relevant f inancial information and enable the institution to communicate operating results 
and financial position to internal and external constituencies. 



FIGURE 3 

Criteria for an Eflective 
Accounting System 
1 dentify and record all authorized 



transactions 



2. 



Record transactions on a timely basis and 
in sufficient detail for proper classiHcation 



3. 



Record the transaction's monetary value in 
the financial statements 



4. 



Determine and record when the transaction 
actually occurred 



5. 



Present the information properly in the 
financial statements 



Source: O'Reilly, Hirsh, Dcflicse, Jaenickc, 
Montgomery's AudUingy 11th ed., 
pp. 191-193. 
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Control Procedures 

Control procedures are the policies and systenis that have been established to provide 
reasonable assurance that the institution's control objectives will be achieved. 

To ensure proper control (e.g., assets are safeguarded, managerial policies are foUov/ed, 
reliable information is created or compiled) process checks and balances, external oversight, and other 
administrative governors are built into, or layered onto, work processes. In general, these steps 
contribute nothing tangibly constructive to the process. They do not, for example, cause invoices to be 
paid, ledger accounts to be updated, bills to be sent out, and so on. However, such steps do serve to 
ensure that these activities CKXur in a manner — and with an outcome — that meets set nianagement 
objectives. In contrast to the policies and procedures that are part of the control environment and 
accounting system, which relate to all relevant transactions, control procedures may be established only 
for high-volume or high-risk classes of transactions. Control procedures can apply to any level of the 
organization. Historically, procedures fall into broad categories, including proper authorizations, 
segregation of duties, documentation or record keeping, and independent reviews. The effectiveness of 
these control procedures is enhanced if they are routinely reviewed. 



Control Objectives 

Tl^e control environment, accounting systems, and control procedures broadly encompass the 
policies, procedures, methods, and records implemented to achieve four financial affairs control 
objectives. 

Objective 1: Safeguarding assets 

Objective 2: Encouraging adherence to managerial policies 

Objective 3: Generating appropriate financial transactions, and reliable, timely financial 
information 

Objective 4: Promoting operational efficiency 

These four objectiver. of the traditional control structure of financial affairs areas are, in theory, 
embedded in each of the structure's elements: the control environment, the accounting system, and the 
control procedures. Achieving these objectives will suppon the accuracy, reliability, and efficiency of 
the execution, compilation, recording, and communication of financial transactions and information. 
As such these objectives support effective financial management of the institution and should be liiiked 
to the institution's basic mission and strategic objectives. 

It is not difficult to see how the control structure works to meet the f irst three of the four control 
objectives. A few examples of various interrelationships follow. 

■ Control Environment: The integrity, abilities, and actions of management are directly 
linked lo the organizational culture and the extent that organizational policies are followed. 
(Objective 2) 



IG 



10 Cost-Effective Control Systems 



■ Accounting System: The accounting system is structured to facilitate the timely and 
accurate execution of financial transactions, such as paying vendors and billing students. 
(Objective 3) 

■ Control Procedures : Cash reconciliations and scientific equipment inventory controls help 
ensme that ^hese valuable ai).d appropriable assets remain at the institution and under the 
institution's control. (Objective 1) 

■ Control Procedures: Transactionreviews and authorizations work to ensure that only valid 
claims against an institution's resources are paid and that all such payments are correctly 
categorizeci^ analyzed, and reported. (Objectives 1 and 3) 

It is significantly less clear how the control structure meets the fourth control objective of 
promoting operational efficiency. In fact, ^he control environment, accounting system, and control 
procedures only indirectly support the fourth objective, though tliis fourth goal may be the most critical 
of them all. For instance, at a high level, accurate and timely financial information enables management 
to analyze the institution's position against internal needs, the requirements of extemal constituents, 
its competition in the education industry, and the economy. As such, the control structure can enhance 
managerial effectiveness and support timely, targeted responses to emerging issues. More narrowly, 
within a specific department the intemal contiol structure can help promote financial operating 
efficiency through the reduction or elimination of inappropriate disbursement of funds. These two 
examples demonstrate how the control structure supports efficient operations and effcjtive adminis- 
tration. 

However, the control stnicture will not promote the operating efficiency of the financial 
transactions themselves. This is because the control structure does not, in and of itself, support the 
evaluation of the cost-benefit relationships of controlling; there is no intemal mechanism to indicate 
when controls impede the execution of a transaction or the compilation and communication of relevant 
financial information. Therefore, the control structure caimot serve as a vehicle or indicator for 
operational efficiency. 



Problems with Control 

The objectives and elements of control structures are not inherently inefficient; the implemen- 
tation and evolution of these structures are different matters. Quite simply, many administrative 
processes have become well-controlled systems that incidentally provide service. This is a harsi? 
statement, yet this phenomenon appears again and again at well-controlled versus well-run institutions 
and relafes back to the lack of an intemal mechanism to ascertain when the cost of control exceeds the 
value of control. The following are examples of imbalances that may sound familiar to many college 
and university administrators. 

■ The buildings and grounds department of a small college in New England has developed 
procurement practices that would foil almost any effort to defraud the college. However, the 
process has become so cumbersome that supei-visors are spending close to 40 percent of 
their time on paperwork, and vendor discounts are frequently lost because payment 
turnaround exceeds ten days. 
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■ The process to change personnel information at a major research university provides 
another instance of an imbalance between control and service. Changing an employee's 
mailing address requires four signatures and takes as long as three weeks to reach the 
computer system. In their efforts to control and maintain accurate information, one 
department after another layered an additional approval onto the records management 
process. 

■ A prestigious technical university created budget controls over copies that, for many 
copying orders, cost more to administer than the charged-back amount; in a similar light, 
another university spent $500,000 per year (costs included salary and operating expenses) 
to administer and control $1.5 million in accounts payable transactions. 

■ A university with more than $150 million in endowment funds ran a monthly verification 
of the dividends received through a complex four-way reconciliation of custodial account 
records, investment managers' statements, general ledger listings of the endowment 
portfolio, and index card records of each investment. The reconciliation, which took over 
one worker-week per month (plus the time and cost of maintaining the detail general ledger 
and index cards) had identified one missed dividend paym.ent (worth less than $10,000) in 
the past two years. 



Education is not alone in this problem: 



■ At one manufacturing company, "it used to take 35,000 transactions a month to account 
for 3 percent of the total cost." Through "some simple consolidation of routing sequences," 
the company got the number of transactions down to sixty. As a middle manager 
commented, "Accounting had to accept the fact that all its transactions were costing the 
company money and earning nothing." Now, the company spends a lot less time on control 
but ends up with accurate data. The data are less precise but, overall, more accurate, 
efficient, and timely, a fact that was proven through improved performance.^ 

■ Another company, specializing in electrical equipment, handed its new president four 
manuals of 760 corporate policies and procedures. The president dumped the rule books, 
and the corresponding emphasis on controls and regulations, in favor of 11 policy 
statements. So far, the president's mix of communicating, training, and trimming seems to 
be working. Since 1984, the company has cut its workforce by 17 percent, but increased 
sales from continuing operations by 37 percent.'' 

■ When faced with excessive costs, even after significant layoffs, one oil company set out 
to identify work that did not need to be done. Unnecessary components of the control 
structure were the first to go. The company junked 25 percent of all intemal reports, reduced 
from twenty to four the number of signatures required on requests for capital expenditures, 
and compressed from seven months to six weeks the time it took to produce its annual 
budget.** 

A common thread runs through each of these examples. Most likely, the control procedure 
originally addressed one specific need within one isolated department. As the organization grew and 
became more complex, the control became less effective or no longer met the needs of all departments 
to which it was applied. To compensate, additional steps or controls were layered on top of the original 
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process. Over time, the original solution and problem were lost in a complex maze of procedures and 
paper, ultimately serving no department effectively. 

Inefficient control structures, like inefficient functions, decrease the quality of customer 
service while increasing the cost of operations. As illustrated by the examples above, inefficient controls 
can actually delay the execution of the function and can increase cost without added value. Obtaining 
several approvals or requiring additional documentation can unnecessarily complicate a relatively 
simple process. Likewise, additional steps to record information in various locations, or '^shadow 
systems," can also delay processing. These delays and other excessive controls can increase the cost 
of the operations — a particularly ironic result given that these controls are often intended to ensure 
appropriate expenditure of university funds. Finally, ineffective controls also create a bureaucratic 
operating environment that is difficult to adjust to changing customer needs. The layers of regulation, 
procedure, and administration create an inflexible inertia within the organization. 



The Mandate for Effective Control 

Taken together in a time of difficult institutional finances, the double sins of inhibiting 
customer service and adding urmecessary costs create a mandate to restructure inefficient administra- 
tive functions, including their control structures. Inefficiency is at best an expensive luxury in limes of 
plenty, but becomes untenable as profitability declines. For colleges and universities, a more 
challenging environment (irxluding heightened competition for students, research funds, and philan- 
thropic support) creates constraints on institutional revenues. These constraints mean that institutions 
must be both effective in the provision of appropriate services and efficient in their delivery. 

The next section proposes a response to this mandate by outlining a theoretical firamework for 
improved control structures that helps administrators to more cost-effectively manage and control risk. 
Although the following framework applies to most procedures and controls, institutions must still 
consider the level of financial risk assoc iated with the processes. Note that the proposed framework will 
not always mean reducing controls. In certain instances, such as ensuring compliance with federal 
regulations, multiple layers of strong control may be justified, especially when large revenue streams 
may be at risk. 
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A rallying cry for transaction process reengineering is, "Stop paving the cow paths! Instead 
of embedding outdated processes in silicon and software ... obliterate them and start over."^ As the 
outdated methods are obliterated and new approaches are developed, the mechanisms by which the 
process is controlled must necessarily change as well. These business process changes are made within 
the context of institutional goals, including increasing efficiency, reducing costs, and improving 
customer service. A less-bally hooed benefit may be control that is less obtrusive and more efficient than 
in the past. 

In this section, the authors explore a new paradigm for controlling operations (particularly in 
the financial area), that can guide the creation and implementation of effective control structures in 
streamlined operating environments. To do this, the authors: 

■ identify how the driving forces of business (at both a for-profit and nonprofit level) affect 
control systems, and how these forces have changed; 

■ reevaluate the traditional purposes and objectives of control in light of these new driving 
forces; and 

■ define a model for designing effective control systems that takes into account both the new 
driving forces in business and the ongoing need for appropriate assurance. 



Control Systems and the Business Environment 

Control structures should be (and historically were) driven by the business environment. In 
recent years, the environment has changed, yet many control structures still reflect the historical 
business processes. 

Today's control systems were developed in the 1940s in an entirely different business 
environment. Business characteristics from this era included: 

■ a sharply centralized, piersonalized decision-making structure where authority and 
knowledge were vested in a single person, often the boss at the top; 

■ efficiency principles from early industrial America, including fragmented business 
processes that required each person to perform one, isolated task repeatedly before handing 
off to the next person in the '^office assembly line"; 
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■ manual transaction processes and record keeping, where accuracy was dependent entirely 
upon human factors and the risk of error was very high; and 

■ a less-educated workforce performing the tasks associated with financial processing. 

How did these factors affect processes and controls? Controls were designed to defer all 
important decision to the upper management by requiring high-level approvals. This hierarchical 
stiTJcture in part compensated for a less-educated workforce and fragmented processes and in part 
reflected a strongly paternalistic and centralized societal fabric. Control systems made up for highly 
fragmented processes by having multiple checkpoints in any process. Employees were repeatedly 
checking everyone else's work. Control structures compensated for highly manual processes (and 
therefore higher error rates) by having multiple supervisory reviews and approv als, extensive records 
of transactions, and multiple back-up systems and files for verification and information access. 

As times have changed, the business environment has also changed. A few instances of this 
radical transformation follow. 

■ Increasing business complexity in many industries has dictated the decentralization of 
decisions to the appropriate loci of knowledge throughout enterprises, changing the roles, 
relationships, and communication pattenns among the managerial levels. 

■ High-quality customer service has risen as the primary andexplicit concern of enterprises. 

■ Radically changing information technology has enabled breakthrough approaches to 
business issues without the former constraints of manual processing speeds and the 
accompanying linearity, random human error on repeated calculations or transactions, and 
information access limited by the number of duplicate copies and filing systems. 

How have these driving forces of complexity, customer service, and information technology 
been reflected in business operations?niree examples address thequestionby way of illustration. First, 
many multifaceted corporations have delegated product-specific tactical decisions to line management, 
while focusing top management on policy, strategic direction, and oversight of the enterprise. Second, 
to enhance customer service through improved product quality , some manufacturers have moved away 
from age-old assembly line processes in favor of autonomous and accountable product teams. Third, 
computer-aided design and computer-aided manufacturing systems (CAD/CAM) have radically 
enhanced industry's ability to produce cost-effective, customized solutions to customer-specific needs 
(combining both enabling technologies and customer service). 

Higher education shares these changes of increasing complexity, a growing concem for 
customer service, and increased use of information technology. For example, many large universities 
have migrated to an administrative structure characterized by largely autonomous operating divisions 
(undergraduate, graduate, and professional institutions; auxiliary operations; hospitals and other 
^^independent" operations) and centralized functions for mission, policy, and resource allocation 
decisions and for campuswide oversight. Second, to improve customer service in the admissions 
process, many institutions have adopted a practice of assigning applicants to a counselor who is 
responsible for the applicant throughout the admissions process and who is ultimately accountable for 
the conversion of accepted applicants to enrolled students. This clearly parallels the shift to autonomous 
product teams in industry. Third, several institutions have developed and implem.ented highly 
automated registration processes that allow the student to register in advance, by phone, and from the 
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home, dorm, or any other location served by a touchtone system. 

How should a new control model meet the needs of an altered business environment? To 
develop this new model, it is best to first consider the purposes and objectives of the control structure. 
From there, it is possible to discuss specifical ly how the elements of the control structure should address 
the new business needs. 



A Reevaluation 

Responding to the changed business environment requires no change in the definition of the 
purpose of internal control, a slight expansion of the objectives, and substantial rethinking of the 
implementation of the control elements. 

The Purpose 

The authors assert that under a new system for control applicable to streamlined administrative 
processes, the traditional purpose of the control structure remains unchanged. The purpose of the 
traditional control structure was to safeguard the institution from unintended exposure to business, 
accounting, and financial risk. Stated differently , the purpose of the internal control system is to provide 
institutional constituencies with reasonable assurance that specific entity objectives will be met. These 
concerns are still valid: there has been no economic shift that diminishes the need for this assurance or 
protection. 

Although redesigning controls frequently involves the elimination of familiar and comfortable 
controls su'ch as inspection and multiple approvals, these stripped-down control systems must still meet 
the traditional purpose of risk management for the purpose of achieving institutional objectives. In fact, 
it can be argued that by focusing on risk management instead of process management, these often 
starkly slimmer and less-obtrusive controls more appropriately meet the puipose for which internal 
control came about in the first place. 

The Objective 

To respond to today's business environment, the scope of the control objectives of financial 
areas must be expanded to encompass the institutional objective of appropriate customer service. 

In the contemporary business environment, management still has a need to safeguard assets; 
encourage adherence to managerial policies; generate appropriate financial transactions, and reliable 
and timely financial information; and promote operational efficiency. This is consistent with the 
traditional construction of control objectives. 

There is a new objective, however, driven by the business environment and necessarily 
incorporated into the finance areas for consistency with institutional objectives: appropriate customer 
service. This means that the objective of the department or area must include a mandate to provide 
customer service (quality, cost, content, and timeliness) that is in step with institutional goals. The 
control system must reflect this increasingly important business objective by giving management 
reasonable assurance that appropriate customer service is being provided. 

The Elements of Control 

The elements of control — environment, systems, and procedures — must be changed in design, 
implementation, and maintenance. Changes in these three areas form the specifics of a new model. 

As the processing environment shifts from afocus on well-controlled systems that incidentally 
provide service to customer service operations that are appropriately controlled, tlie control environ- 



22 



16 Cost'Effective Control Systems 



ment necessarily changes as well. The customer service orientation of streamlined processes forces 
a shift in the control emphasis from oversight and end process quality review to less-obstructive, risk- 
sensitive controls designed to support lower defect-rate processes. 

This shift affects low-risk transactions in two ways. First, the "tone at the top" should establish 
simple, straightforward guidelines for low-risk transactions so that there will be less opportunity for 
error in the first place. Second, managers should recognize that the expense of controlling directly 
against the risk of small errors or fraud may be more cosdy than the financial consequences of small 
error or fraud. Managers who choose not to control strongly against these risks must admit realistically 
that some costs due to error or fraud will be acceptable. Of course, indirect controls in the control 
environment (e.g., management integrity, the communication of ethical values, and managerial 
compliance with existing policies) still provide powerful disincentives. The other side of the issue is that 
the savings from reduced processing costs and the increases in customer service from more effective 
controls will justify the low level of costs incurred from the increased exposure to risk. 

The category of **high risk" will also be affected by tlie shift in control emphasis. First, the 
category itself will be more clearly defined in term of specific risks and costs. Clearer, more focused 
definitions may help to reduce the number of transactions labeled as high risk. These transactions will 
be subjected to the specific type of control, which addresses the particular risk, rather than historical 
blanket controls. 

Understanding and managing financial risk becomes a much stronger element of the control 
environment as process mr^iagers move away from financial accountability at all costs to accountabil- 
ity to customers — meaning high-quality services at appropriate costs. This does not imply that financial 
accountability is no longer desirable; rather, such accountability is an important aspect of the customer 
service that is the focus of the organization. Again, the tone from the top must convey to managers that 
the focus is no longer isolated process and transaction management, but is instead integrated customer 
service and financial management. From this viewpoint, the primary responsibility is to serve 
customers and then to balance the service requirements against controlling risks. The environment must 
promote this attitude in order to allow middle managers to change controls. 

In summary, a new model for the control environment now includes an upper-management- led 
emphasis on customer service and a conscious analysis of risks, costs, and benefits. The control model 
retains its traditional elements of integrity, ability, and awareness. Employees in financial areas become 
service and account agents rather than financial transaction processors and recorders. 

Financial systems are changing; with their increased sophistication and integration, the 
frequency and nature of human interaction with individual transactions decreases, changing the ways 
in which the transactions are controlled. In the past, accounting systems were designed to solely collect 
and report accounting transactions. Today, comprehensive accounting systems are available that not 
only collect and report transactions, but also integrate, facilitate, and streamline many of the business 
processes required to run an institution. In both financial and student information systems, integrated 
and paperless processing can now be used to reduce manual steps, system-to-system rekeying, and 
paperwork in a variety of financial and operational transactions (e.g., purchasing from requisition 
through vendor payment, payroll, and financial aid\ 

As part of the transformation in automated processing, electronic edits and checks, based on 
database rules that reflect institutional policies, can replace many of the traditional (and more 
cumbersome) manual inspections and approvals. Automated systems can also be used to segment the 
body of transactions by preprogrammed, risk-based criteria. Such systems can route low- and high-risk 
transactions through different processes that prompt for, and require, different forms of human 
intervention to proceed. Thus, an important characteristic of the implementation of this element of the 
control system is that computer systems can take advantage of the capacity of technology to provide 
integrated, in-process controls and transaction processes that are stratified by risk parameters to 
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prompt for alternative controls or human intervention as appropriate. 

As institutions redesign processes for increased efficiency and customer service, control 
procedures are evolving away from the traditional control gates of multiple checks, reviews, and 
authorizations and into more flexible and cost-effective practices characterized by risk-sensitive 
control procedures that leverage technology and in-process controls. Today's new control systems use 
risk and cost/benefit analyses to determine the level and nature of appropriate control over transactions, 
assets, and information. Thus an important aspect of Ci^ntrol is the procedure that channels business 
processes through the appropriate controls. In addition to segmenting business processes by risk levels, 
the new control procedures are different in that they: 

■ rely more on decentralized responsibility for, and authority over, transactions; 

■ employ simpler or more streamlined approval structures, reflecting true authority; and 

■ are integrated into efficient and streamlined processes thai emphasize customer service 
first and control second. 

Note the large overlap between the control elements of the financial system and control 
procedures. This is the logical result of implementing efficient, in-process controls. 

There is a new element to the control structure that has yet to be added: continuous 
improvement. Just as a Total Quality Management style of managing an enterprise includes an 
emphasis on continuous improvement (feedback, rethinking, redesigning, and reimplemeniing), ihe 
internal controls of an institution must be monitored,e valuated, and updated to ensure that they continue 
to meet institutional requirements for control in the context of a dynamic business environment. 



A New Paradigm 

The paradigm is practical and solidly grounded in new management philosophy. Simply put, 
effective control systems provide the board of trustees, management, and/or other personnel with 
reasonable assurance of the achievement of institutional objectives through the cost-justified manage- 
ment of risk. There are four elements in this model that form the criteria for effective control systems 
in a streamlined operating environment. 

■ Reasonable assurance-the idea that control systems should not be over- or under-designed 
to provide higher or lower levols of assurance than management requires to meet the 
institution's objectives. 

■ Achievement of institutional objectives-the concept that it is inappropriate to manage 
departments as well-controlled operations that provide some form of service; rather, good 
control systems support the immediate customer and, more broadly, the enterprise by 
helping to ensure that the department meets customer needs. Each department must focus 
on the instuution's objectives, translate these to the specific business objectives for the 
department, and implement the processes and controls to meet the newly defined objectives. 

■ Cost-justified-the tenet that the balance between cost and benefit cannot be tipped so that 
the costs of an institution's control systems are disproportionately large given their benefits. 
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■ Management of risk-the knowledge that controls designed to monitor and manage 
processes will not necessarily manage exposure to risk effectively . Control procedures need 
to be focused on the specific risks they are designed to address in order to control exposure 
to risk with a minimum of interference in the business process. A corollary to this thesis is 
that more control is not "better" and may be worse" once a desired level of risk management 
has been achieved. 



IV, Putting the Paradigm to 
Work: Examples from 
Practice 



In many common university business processes, institutions are redesigning process work 
flows, approval structures, and the roles and responsibilities of both central and distributed staff in 
order to maximize customer service and minimize cost. With far fewer steps and layers of control, these 
systems can still be well-structured and managed to minimize underlying fmancial risks. 

In this section, several case studies are presented that illustrate imbalances among control, cost, 
and service, and demonstrate the substantial benefits that may be achieved with focused improvement 
efforts. Each of these case studies is a real-life instance of controls that went awry. In these examples, 
tighter budgets and increased expectations for service caused particular departments to raise red flags 
and reengineer the way they conduct business and control fmancial activities. In every instance, the 
reevaluation of old control structures was part ol the process leading to significant benefits in terms 
of cost, service, and quality. 



Example 1 : Procurement at ABC College 

The procurement function of many institutions can be streamlined to allow individual 
departments or employees limited authority to directly purchase items and pay vendors, decreasing the 
purchasing time lag and costs. This can be done at acceptable levels of risk to the institution. 

Figure 4 diajjrams the procurement and payment processes within the buildings and grounds 
department at ABC College, a small liberal arts institution. This case study is particularly relevant, as 
the procedures evolved in response to citings of inadequate control and even fraud in the management 
letter of the audit report. The resultant process was ridden with controls, as indicated by the shaded 
boxes. 

Before 

ABC's procurement process was developed to address the risks of inappropriate purchases and 
unethical selection of vendors. To control these risks, management set relatively low limits for required 
competitive proposals, and instituted rigid controls to monitor both orders and payments. Although this 
structure certainly thwarted inappropriate expenditures of funds, it also impeded prompt service and 
created unnecessary work. For example: 

■ Every transaction above $600 required four complete sets of approvals: two sets for 
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purchase and two sets for payment. The first "purchase" approval, labelled A, provided 
immediate, verbal feedback to the overseer. The second (labelled B) approved the purchase, 
vendor, and account number. For payment, the supervisor approved accuracy of billing and 
account numbers in the first set of payment approvals, labelled C. In the second set of 
approvals, labelled D, management again approved the supervisor's purchase and choice 
of account numbers. These approvals provided strict control over each purchase decision 
and choice of account number, but also forced repeated upper-level management attention 
to essentially the same transaction. 

■ As an additional control, a separate form was created to approve payment to vendors. 
Detailed account numbers and item descriptions were manually transposed from the 
purchase order to the payment form. Tlie form consolidated all purchasing and accounting 
information onto one sheet, allowing easy control and review of information and enabling 
careful surveillance of payments. 

■ To maintain control over detailed accounting information, buyers were required to 
calculate vendor discounts (of oniy 1 -3 percent) by hand before forwarding invoices to the 
con trolle: 's office, even though accounts payable automatically calculated the discounts on 
the computer as part of the data entry. By calculating the discounts in advance, the 
overseers' accounting records matched the controller reports to the penny, thus ensuring a 
high degree of precision in information, reconciliation, and budgeting. 

■ The control that set the minimum dollar limit for required competitive bids was quite low 
($600). The result was that fully 20 percent of the processing and control costs were devoted 
to less than fiv^, percent of the dollar volume in purchasing activity. This policy did, 
however, ensure selection of the lowest cost bidder and reduced the possibility of favoritism 
or kickbacks, 

■ Duplicate information was entered and maintained in five different areas: a manual 
journal, the buyer's files, the financial assistant's files, the ledger subsystem, and the general 
ledger. These record systems carefully controlled information but did not improve service 
or accuracy and, in fact, impeded the process flow. 

■ Furthermore, to accommodate the duplicate filing systems maintained above, separate 
data entry sheets were used, and again detailed information had to be transposed from one 
form to another. 

» Because of the procedural complexity and controls, almost 100 percent of rejected 
transactions were rejected for clerical errors rather than true errors in procurement and 
payment practices. These rejections, of course, delayed processing and created more work 
for the buyer. 

As these examples suggest, ABC's procurement process was not only cumbersome, it was 
expensive. The processing and contrc / costs (salary) were estimated at $143 ,000 for the buildings and 
grounds department, with the majority of dollars spent on low-dollar purchases (see figure 5). In the 
finance area, an additional $49,000 was spent, again predominantly on low -dollar purchases, to make 
the vendor payments and record the transactions. Thus, approximately $ 1 92,000 was s{jent to purchase 
$3 million in supplies. 
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The irony is that while this coiitrol structure regulated every transaction in minute detail, it had 

one significant weakness. From the vendor's 
perspective, buyers were authorized to commit 
$5,000 of the college's funds but were not 
authorized to approve payment above $600. 
This policy is analogous to having "tear off 
purchase orders with a $5,000 limit. Thus, 
several weeks after the goods had been deliv- 
ered and used, the invoice would arrive , and the 
college would be committed to paying on the 
approved purchase order. The unapproved in- 
voice, in effect, had gone through the approval 
process ex post facto. What, therefore, could 
the director's payment approval truly control? 

After 

Certainly, management still needs 
to control against inappropriate purchases and 
unethical selection of vendors. However, the 
streamlined, proposed process, detailed in fig- 
ure 6, puts these concems in the context of 
managing the overall exposure to financial 
risk. The process is redesigned to closely moni- 
tor purchases of high value and to speed pro- 
cessing of low-dollar, and therefore low-risk, 
purchases. The improvements were relatively 
simple (changes in the control structure are 
summarized in figure 7). 

■ The dollar limits for required bids were 
raised, based on economic factors, tem- 
pered by comfort levels within the depart- 
ment. The proposal process continues to 
ensure the selection of the lowest bidder 
and reduction of favoritism; however, the cumbersome proposal process now focuses on the 
higher-dollar purchases so that the higher control levels are matched with the increased 
processing costs. With a new limit of $1,500, only 4 percent of transactions must now 
undergo the bid process (as compared with 1 1 percent at the $600 trigger), yet this accounts 
for 88 percent of the total dollar volume in purchasing activity. 

■ The dollar limits on approval requirements were also raised. Buyers are now authorized 
for $ 1 ,5(X), and assistant directors can purchase up to $5,(XX) on their own signature. With 
these limits, roughly 74 percent of the dollar volume is still controlled at the dii-ector level. 
Once again, raising approval limits helps to ensure that increased processing costs are 
dedicated to high-dollar transactions. The approval structure also ensures that ?npropriate 
controls are affixed to high -dollar, and therefore higher-risk, purchases. At the same time, 
service and turnaround time are improved for lower-dollar purchases, as the purchasing 
authority of supervisors is matched to their responsibility. Supervisors can now purchase 



Figure 5. Process Performance 

Statistics of Procurement 
and Payment at ABC 
College 

Procurem 

Processing Time 

Over $600: 1-7% hours per 
P.O. 

(with bids) 

Under $600: >4-3% hours per 
P.O. 

(no bids) 
Total Processing Costs: $143,000/year 



Invoice Payment 
Processing Time: hours per P.O. 

Total Processing Costs: $49,000/year 
Error/Rejection Rate: 15% 
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most of the goods they need to complete their daily jobs without seeking higher-level 
management approval. 

■ The approval controls were also changed in a second way. Rather than separately 
approving both purchase and payment, management approvals are required only when the 
commitment to buy is made. Once the invoice arrives, approval for payment becomes a 
clerical function of matching invoices to purchase orders and bills of lading. This structure 
provides adequate responsibility for each supervisor's high-dollar purchasing activity with 
one up-front approval. These procedures also eliminate the cumbersome separate form for 
payment that previously required management approval. Clerical approvals can simply be 
written directly on the invoice and forwarded to accounts payable. This was the most 
significant change to ABC's procurement system, because taking the supervisors out of the 
payment process cut turnaround time in half and substantially reduced the paperwork 
involved. 

■ Supervisors are no longer required to calculate vendor discounts, as the *'to the penny" 
precision was unnecessary. Instead, suf)ervisors and managers use more readily available 
and timely, but less precise, information from accounting; this provides them the accuracy 
needed to manage overall budgets. 

■ By transferring the responsibilities of record maintenance, error resolution, and vendor 
relations to a central clerk, supervisors no longer need to maintain files of detailed 
purchasing and accounting papers. The responsibility for the detailed information now rests 
with one individual, which increases consistency and completeness. 

■ Finally, 46 percent of the invoices are less than $ 100, representing only 1 .2 percent of the 
total procurement dollars in buildings and grounds. To minimize the processing costs of, and 
the time consumed by, these high-volume, low-risk transactions, the college instituted a 
"Quick Check" policy. Each supervisor is periodically given a controlled number of checks 
that are stamped, "Not to Exceed $ 1 00." Carbon copies of the checks, with account numbers 
written directly on the each check, are forwarded to accounts payable, where checks are 
verified and keypunched into the general ledger. Additional control is maintained through 
random audits of transactions on a monthly basis. 

In summary, the process was streamlined by identifying the controls that truly added valuable 
assurance against substantial financial risks, and by eliminating costly blanket controls. The matrix 
compares the former control structure to the new model. The new structure does not provide equivalent 
control but instead institutes appropriate control. Rules and regulations over low-dollar but high- 
volume transactions were minimized. Approval structures were altered to focus management attention 
on the high-dollar transactions that represent the bulk of the department's spending. Extra forms and 
filing systems that increased work but added little value were eliminated, and routine processing was 
transferred from skilled workers to clerical staff with no loss in control. Periodic internal audit reviews 
of randomly selected transactions and individual supervisor transaction volumes decreased risk of 
misuse of funds under the Quick Check function. The resulting process allows management to focus 
on the more sensitive, higher-dollar transactions. Faster processing alsogives the benefit of more timely 
information that is more accurate overall for planning and making decisions. 

The changes in the procurement process controls not only enable supervisors to obtain suppl ies 
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with little bureaucratic delay but substantially reduce the processing costs as well (see figure 8). Most 
importantly, for the context of this example, the process remains efficiently controlled. Seventy-four 

percent of the department expenditures under the 
proposed structure are controlled at the director 
level, with another 14 percent of the expenditures 
managed at the assistant director level. The bid 
system also ensures appropriate selection of vendors 
for 88 percent of the department's expenditures. 
Abuse of low-dollar purchases is administrated 
through limited access to Quick Checks, monthly 
budget variance analysis, and periodic random au- 
dits of Quick Check purchases. Financial exposure 
is essentially limited to these low-dollar, high-vol- 
ume transactions (Quick Checks). Nonetheless, un- 
der the proposed structure, the streamlined rules and 
regulations still mitigate the possibility of abuse 
without costing ABC more than the control is worth. 

Thus the college is able to procure job 
supplies and process payments more quickly, at 
lower transaction costs, and at acceptable levels of 
risk. 



FIGURES 
Overall Improvement Statistics 
at ABC College 

Reduction in procurement processing 
Costs: 26% ($37,000) 

Time: 23% 

Reduction in payment processing 
Costs: 55%,.^$27,000) 



Time: 



46% 



Example 2: Personnel Record Processing at DEF University 

This example shows thatpersormel records can be electronically seginentedto provide different 
types of controls for different transactions within a centralized personnel management system. The 
personnel/payroll information management function is changing significantly due to the increasing 
sophistication of technological support. Institutions are reducing the number of approvals required to 
process information, allowing more on-line access to personnel data, and consolidating human resource 
infonnation in centralized "people" files. The key to the successful reduction in the control systems 
inherent in these advances is matching the level and extent of control with the namre of the trancHction 
risk. Timeliness, efficiency, and financial savings may be enhanced with the implementation of well- 
planned changes. 

Before 

In this example, as depicted in figure 9, the same process and approval requirements were 
imposed upon every transaction, regardless of the risk to DEF University. The process progressed as 
follows: 

1 ) In the first shaded box, the department's business manager controlled the information at 
the source by certifying that the change was indeed appropriate and correct. 

2) Then, for grants and contracts, the principal investigator verified the accuracy of 
charging instructions and salary splits. 
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3) The next three steps also approved the information but almost never rejected changes — 
a clear indicator of an unnecessary control. Except for salary- related changes, these offices 
were not adding value but instead were simply controlling rtccess to the most recent 
information (addresses, name changes, etc.) and maintaining costly duplicate information. 
In fact, the various offices had different understandings of how to correctly complete the 
form, and often delayed the process by double-checking or second-guessing other offices' 
work.. 

4) Finally, in the last two shaded 
boxes, the personnel and payroll clerks 
added further controls by again veri- 
fying clerical accuracy. They also 
coded the fonns for keypunching. 



FIGURE 10 

Improved Process to Change Personnel 
Information at DEF University 
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Performance of this system was character- 
ized by the following statistics: 

■ The processing time could add up 
to as much as two to nine weeks. 
Among other side effects of this slow 
method, payroll checks were fre- 
quently sent to the wrong address 
(due to a three week average turn- 
around time for changing a mailing 
address). 

« Processing costs were approxi- 
mately $12 per form in labor costs 
alone, resulting in total processing 
costs of approximately $200,000 per 
year in labor. 



After 

The improved process, zs detailed 
in figure 10, is designed to control sensi- 
tive, higher-risk payroll/personnel infor- 
mation (e.g., salaries, new hires, etc.) but 
maintain routine information at the depart- 
ment level. 

First, administrators required all 
departments to use centralized computer 
files directly, instead of distributed paper 
forms and centralized data entry. This 
change improved efficiency and consis- 
tency. The computer provided up-front er- 
ror checks on the data entry level, increas- 
ing accuracy at the source and eliminating 
the need for the muhiple manual checks for 



Putting the Paradigm to Work 29 



clerical accuracy. Additional control over salary change inputs is provided by the approval process. 
Coding and mass keypunching are eliminated through on-line data entry, thus reducing the number of 
people who handle the forms and information and increasing control over entry errors. Controls are 
still needed to ensure the integrity of the operation of the computer system, as in all other applications 
of administrative computing. 

To develop an approval structure, administrators identified the number of personnel/payroll 
changes possible, and then the corresponding approvals required. On the computer, a field for each 
required approval is now '^flagged" so that transactions cannot be processed until the entry of all of the 
appropriate passwords. The approval structure was also changed to a parallel structure, instead of the 
former serial system, with the result that several administrators can access and approve the transaction 
at any time without waiting for a previous administrator's approval. This change reduced the lag time 
associated w \± a form sitting in an "in" or "out" box in the old system. Read-only access to information 
in the payroll system is provided to offices previously notified of changes through the manual PPC 
approval process. 

The matrix in figure 1 1 summarizes the changes to the control structure inherent in the 
implemented streamlining process. Controls are maintained under the new structure through electronic 
segmentation and routing of transactions by required approval level. Clerical accuracy in changes to 
critical fields is enhanced by the elimination of separate coding and keypunching steps through direct 
entry of data by the originating office. Meaningless controls (e.g., the provost's approval of a change 
of address) are eliminated, as is the need for information shadow systems. 

This example highlights the role technology can play in supporting effective control in a 
streamlined environment. Here, risk-sensitive in-process controls replace the bureaucratic and 
obstructive blanket regulations of the previous, largely manual, personnel management system. 



Example 3: Student Accounting at GHI College 

Often, as processes are computerized, remnants of the old manual control procedures remain 
intact, inhibiting the efficient use of computerization. Such is the case in this next example. 

Before 

At GHI College, a small liberal aits institution, antiquated manual control procedures 
complicated potentially simple computerized financial processes. Over several years, many offices at 
GHI were able to computerize their student an<J financial records. Unfortunately, most offices had 
initiated independent computerization efforts, and thus the individual systems were not properly linked. 
Paper forms were used to *'link" the computer systems. 

For instance, in the financial office, student accounting records were maintained on a 
sophisticated computer system . However, the departments that initiated most of the charges againsi the 
student accounts (e.g., housing, dining, and financial aid) had separate, computerized records. Because 
of the lack of integration, the offices were using the computers to mimic the existing "paper system," 
leading to a great deal of redundancy. Therefore, the bursar's office, which maintained the official 
student accounts, insisted upon paper forms for each individual billing transaction, even though most 
offices had already entered the charge record on computer. 

Paper "ch£U*ge bills" were used to initiate and document every nontuition charge against each 
student's account. Usually, the bursav's office would receive a computerized list of charges with all the 
necessary information (name, ID number, account number, and charge description) from another 
department. Each item on thf* list :hen was transcribed by hand onto a charge bill, with one charge bill 
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per student, per transaction. From there, the various copies of the charge bills were distributed or filed. 

Figure 12 arrays the various uses and file systems for the charge bills according to each 
transaction type. The left column lists each transaction type for which the charge bill was used, while 
the remaining columns identify the use of each carbon copy of the paper form. Overall, this paper- 
intensive system, dating back to the 1960s, was intended to ensure adequate control over student 
accounts. 

The use of each copy varied according to the transaction type, but, in general, each copy served 
one of four broad purposes, usually relating to documentation and verification: 

■ White: Served as a data entry template and then provided a master reference for all 
completed charge bills. As an audit trail, this copy was stored in numerical order in a master 
book and was used, although very rarely, for verification in accounting or legal issues. 

■ Goldenrod: Provided a written receipt of all transactions in each student's permanent file 
folder. As another, redundant audit trail, this copy of the charge bill was also used for 
verification, when necessary, for accounting or legal purposes. Although this file system 
added to control by providing a second audit trail, its primary purpose was to answer 
questions about particular transactions relating to a certain student. Because the charges 
were filed by student name, referencing the information related to the specific charge was 
very simple. 

■ Pink: Provided an alternate, temporary file system for charge bills, which were filed by 
transaction type. This file system was also used for verification, and it served the bursar's 
staff by providing easy "look-up" on the particular month's transactions by type. This file 
was important for those transactions that came from outside of the college (scholarship 
checks, bounced checks, parental requests for insurance or meal plan changes, etc.). Once 
the check was deposited, or the parent' s form was forwarded to the appropriate department, 
the charge bill was the bursar's paper record of the individual transaction. 

■ Yellow: Notified the studentor the originating department of the charge before the monthly 
invoices were mailed to the parents. This step provided the control of allowing students or 
the originating department to verify individual transactions before monthly invoices we^e 
distributed to parents. This step also provided the service of allowing students to pay bills 
before their parents were notified. 

Once computerization was introduced to the management of student billing and accounting, 
the paper system became unnecessary, but the old system still lingered. With computerization, each of 
the copies became obsolete for the following reasons: 

■ V/hite: The employees perceived that this copy was needed because each transaction had 
to correspond to an individual piece of paper, the transaction records had to be in a consistent 
format, and these records had to be stored in one complete file. This view is not accurate 
according to the principles of internal control discussed earlier: the standardized format and 
individual records added work, not assurances. To provide adequate documentation for 
control and verification, the bursar simply needs to store the signed charge authorization 
lists received from the originating departments. These lists provide an adequate audit trail 
of complete and accurate original data. Data can be entered directly off of these lists. If there 
is any dispute over the charges or if the computer system crashes, the charges can be verified 
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or reestablished from these lists. The individual charge bills are not necessary. 

■ Goldenrcxi: With computers, this copy no longer needs to be stored in a student's paper 
folder. Each student has his or her own "file" on the computer system, and all necessary data 
can be referenced from this computer file — even more efficiently than by using the paper- 
jammed student file. Again, if necessary, charges could be re-created by referring to the 
original charge lists from the departments if the system were to crash. Furthermore, this 
paper copy is no longer needed to provide necessary service to students. Since all the 
computerized transactions reference their source, the appropriate original charge list could 
be pulled out to answer student questions. Thus, institutional responsiveness to student 
questions was not enhanced by the manual charge bills once the computers were used. 

■ Pink: Again, this paper file is unnecessary because all data can be referenced on the 
computer. If the bursar's office still wants to maintain temporary records by transaction 
type for certain transactions, the individual forms or checks (such as scholarship checks) 
could be copied or recorded on a monthly log. For example, rather than saving individual 
copies of charge bills, the office could log all of the month's scholarship checks on one sheet 
as they are received. 

■ Yellow: This copy is unnecessary from a control pers jective, because students can still 
verify or dispute charges when they receive their monthly invoice. Students are not limited 
to disputing charges only from acharge bill. In this particular situation, GHI administrators 
need to decide whether or not they want to provide students with the opportunity to pay their 
bills before, their parents are notified of any charges. Currently, less than 5 percent of charge 
bills are paid by students in advance of the monthly invoice, which calls into question the 
value of the service provided. 

After 

Upon review of this analysis, GHI decided to eliminate the charge bill system completely. 
Administrators agreed that the charge bill system was adding unnecessary tasks and layers of redundant 
control without either adding significantly to customer service or reducing risk in the nontuition student 
revenue cycle. 

Supervisors decided that henceforth, the departmental charge lists will be stamped with a 
validation number when they are received in the bursar's office. The validation number of the charge 
will be entered as part of the transaction record, and the charge lists will be filed in numerical order in 
one master notebook. If there are any questions about a charge, the student record can be called up on 
the computer; the validation number of the charge can be retrieved; and the original charge can be 
verified from the list in the notebook. 

The next step in this improvement process is to automate the process by linking the various 
computer systems. Then, for instance, the housing office could simply upload authorized charges from 
its system into the financial system. The bursar's office could still audit the transactions by pulling the 
charges up on the computer screen. The paper flow between the offices then becomes unnecessary. 

The benefits of these simple changes are considerable. GHI was processing 3,500 charge bills 
each year (at an annual cost of an estimated $12,5(X) for compensation and form) at an institution of 
only 1 ,200 students. Although this expense may appear low, it is symptomatic of the excessive cross- 
regulations that existed at the institution. Having such an intensive paper system also created additional 
work simply to support the system (i.e., the maintenance of multiple, redundant files, shuffling paper 
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forms back and forth between offices). The tasks associated with the charge bills did not add any value 
to the process . These tasks and associated costs were eliminated by discontinuing the use of the forms. 
Three cumbersome file systems were also eliminated: the master charge bill books, the massive student 
paper files, and the multiple temporary files stored in a top desk drawer. These were replaced by one 
notebook containing one page per month from each department that originates student charges. 

Furthermore, transaction volumes had been steadily increasing, creating an overload situation 
with existing staffmg levels. Over the previous five years, student accounts receivable transactions 
increased by 48 percent. Over the same time period, other miscellaneous accounts receivable 
transactions increased by approximately 40 percent. Because the institution is increasing its student 
population, these numbers were expected to increase even further over the next few years. The current 
process was no longer sustainable with the existing resources. 

Ttie most significant benefit was the positive impact on staff and morale. Staff members had 
already been cut back as part of the college's across-the-board budget pruning and employees were 
overworked, logging significant overtime on a consistent basis. These changes actually eliminated 
work, with the result that employees are now back to regular hours, with less "fu^fighting," and more 
proactive planning and analysis. With the shift in work distribution, the new focus of this work group 
will be reducing the outstanding accounts receivable-thereby improving cash flow-without diminish- 
ing the effective control over the revenue cycle. 



Example 4: Financial Aid atJKL University 

In this instance, it can be seen how the processes of awarding and distributing financial aid can 
be appropriately segregated and controlled without the multiple systems, rekey ing of information, and 
substantial manual checks and reviews used to control currently fragmented processes. 

Before 

The financial aid process at large, complex JKL University was highly fragmented, with three 
completely independent areas controlling various aspects of the process: awarding aid, processing 
loans, and managing accounting/collections. The process was further complicated by the division of 
the award function into 14 separate financial aid offices (FAO) — one for each college within the 
university. 

Maintaining and controlling complete and accurate records are integral parts of any office 
associated with fmancial ai These records are critical for continued funding, and work to prevent the 
tremendous negative publicity that can be associated with allegations of fraud or inappropriate awards. 

Figure 13 shows that the three areas controlling financial aid at JKL had completely 
independent systems for maintaining and controlling this critical information. The diagram conveys the 
complexity of the manual file systems that evolved over the years. However, it does not readily capture 
the redundancy inherent to these systems. In each system, for "adequate control,'' someone had to: 

■ Review identical student information 

■ Rekey student information 

■ Perform batch controls on data entry 

■ Maintain student information in a database 
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■ Retain hard copy of various forms 

■ Perfoim data integrity checks 

■ Maintain manual indexing system to track various files 

■ Conduct periodic audits of files 

These controls effectively manage financial risk f«r>d ensure adequate information to meet 
federal requirements. The problem is that the controls do not need to be repeated throughout three areas. 
The university appropriately segregated the duties of award, distribution, and collection, but over time, 
three separate information systems evolved unnecessarily. The independent data maintenance did not 
create additional control, only additional work. 

With costs for processing one loan ranging from approximately $1 3 to $52 depending on the 
type of loan, JKL needed to streamline processing for the 3,600 loans that flowed through its offices 
each year. Furthermore, the complexity and slowness attendant with processing in three separate 
software environments resulted in delayed deposits, so that JKL was sacrificing an estimated $ 1 00,000 
per year in float earnings. 

After 

When formulating an improved process, JKL identified two critical questions: 

■ Which components of these data storage systems is truly necessary to manage financial 
risk? 

■ How can loan revenues be obtained and deposited faster, without increasing the risk of 
error or inappropriate awards? 

The university recognized that the separate systems actually increased the risk of error or 
inappropriate awards due to the multiple rekeying of information and the lack of shared files. JKL 
moved to link the three systems so that the same student financial aid data was accessible to all three 
offices. Instead of basing computerization on the current, inefficient processes, new processes were 
built off of the computer technology. 

As shown in figure 14, each office still maintains separate student folders for signed legal 
documents, but most forms are computerized and computer transmitted. Certainly, all tracking is now 
computerized, and each office has on-line access to determine application status in other areas. Controls 
and approvals are still tightly maintained, either by computer passwords or by printing out and signing 
the document in question, which then becomes the signed legal document. 

These changes resulted in substantial time and cost savings and also actually increased control 
and accuracy: 

■ Processing time was reduced from 3-12 weeks (average of 5 weeks) to just 2 days. 

■ Float eamings were projected to increase by $96,000, to $ 1 38,000 in interest income per 
year. 
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■ Processing labor costs were reduced from an approximate average of $2 1 per loan to $ 1 3 
per loan, resulting in a savings of $30,000 per year. 

Although the control each unit exercised over the financial databases decreased, control over 
information accuracy was enhanced by the reduced redundancy, and cost was decreased. 



Example 5: Accounts Payable at MNO University 

The case of MNO University proves that high-volume transaction processing can be 
appropriately controlled without undue segregation of duties at a micro level. 

Before 

At MNO University, invoice processing within the accounts payable department evolved over 
time around particular personalities, leading to excessive control, unnecessary approvals, "over- 
division" of labor, and longer processing times. The process was ripe for streamlining, but due to the 
financially sensitive nature of accounts payable, adequate control had to be assured. 

Figure 15 charts the flow of invoices through the department. The process was fragmented, 
with up to six different employees handling independent segments of the process and with intermittent 
supervisory approvals between each segment 

This fragmentation evolved for three control-related reasons: 

1 . The separation of duties ensured that collusion was required to process inappropriate or 
fraudulent transactions. 

2. Supervisory approval was required for any new vendors or unusual purchases. 

3. The supervisor was able to maintain stringent control over each worker's time and 
assignments. 

Ai:er 

When evaluating MNO' s system, the supervisor realized that the third factor was the strongest 
force in this system. Rather than focusing on financial risk, this system was primarily controlling 
subordinates' time, which should be unnecessary in a high-volume processing operation. Furthermore, 
the first factor was unnecessary because segregation of duties was accomplished by separating 
purchasing from payables. Accounts payable employees are not authorized to purchase anything and 
caimoi physically sign the checks; therefore, the processing within the department does not need to be 
divided. In fact, the old system actually jeopardized control because only the supervisor had complete 
process knowledge. If this individual were to leave the university, significant gaps would be left in the 
operation. 

The improved process designates one employee to follow through on the entire transaction. 
Figure 1 6 takes the reader through the new and improved process. The following steps were eliminated 
with no loss of control: 

■ Sorting the mail twice 

■ Counting the mail 
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■ Manually counting a batch before processing 
Furthermore, employees were trained and empowered to: 

■ Reject invoices with incomplete documentation 

■ Determine the need for remittance copies 

■ Determine whether or not to create a new vendor number or to use a dummy number 

■ Correct errors or computer rejections 

These simple changes eliminated the many delays associated with employees dependent upon 
supervisory approval. 

Removing the supervisor from the role of "transaction checker" did not compromise control. 
In fact, it directed processing controls down to the appropriate level and even increased accountability 
by making one person responsible for the entire transaction. 

By focusing on controlling exposure to such risks as unauthorized transactions and incorrect 
payment amounts or recipients, instead of managing process flows with control gates, MNO's 
administrators enhanced accountability at the same time that they decreased processing costs. 



Example 6: Gift and Pledge Processing at PQR University Hospital 

Streamlining is not a panacea for management ills. Indeed, when reviewing administrative 
systems, institutions must ensure that the basic components of an effective control structure are still 
in place. 

In many cases, particularly within small offices, work flows can be so "people dependent" that 
several related responsibilities can be assigned to the same employee for matters of convenience. This 
delegation of responsibilities overlooks the importance of segregation of duties, especially in financial 
areas. 

Before 

Figure 17 demonstrates how one individual in the development office of PQR University 
Hospital was responsible for receipt of gifts, data input, and gift acknowledgment. This is not an 
acceptable model because duties are not sufficiently segregated. Hypothetically, the gift processor 
could open a bank account as the new treasurer of "Friends of Cancer Research at PQR Hospital Then, 
the gift processor could receive a check in the Development Office, deposit it into the processor's own 
account, and send an acknowledgment to the donor without ever entering the gift in the Development 
Office's computer system. PQR would never know that a check had been stolen and would have 
absolutely no record of even receiving the check. Although the overall project review focused on 
operational and efficiency improvements in the development area, this gift processing system was not 
a candidate for streamlining or efficiency initiatives. Although the current system provided fast and 
efficient gift processing with minimal employee resources, PQR was unable to determine by how much 
or with what frequency gifts had been diverted. 
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The improved process is quite simple. Figure 1 8 compares Ihe previous process with the new 
process. One gift processor receives the 
gifts and enters the name and amount 
onto a deposit slip, which is immediately 
sent to the cashier. Copies of the checks 
are then given to a second gift processor 
for data entry, posting, and acknowledg- 
ment. Each batch of transactions is rec- 
onciled to the deposit slip, the computer- 
ized acknowledgment records, and the 
bank's records. Separating the receipt 
and deposit of the gift from the data 
entry and acknowledgment provides for 
segregation of duties. 

There is still one significant ex- 
posure to risk in the proposed model. 
The gift processor or secretary who 
receives the donors' checks could, theo- 
retically, divert the funds and then send 
an acknowledgment on university sta- 
tionery (not a computer-generated re- 
ceipt). There are a few ways to eliminate 
this risk; an institution can use a bank's 
lock box for receipt (but, certainly, all 
donors will not necessaril;^ send their 
checks to the lock box), or can have two 
employees open the mail together. Given 
such alternatives, many institutions 

choose to accept the risk; they must trust one employee who opens the mail 



No segregation of duties between 
receipt, posting, acknowledgment, 
and dep<>i^it of funds. 
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Receipt and deposit are separated 
from posting and acknowledgment. 

Collusion is required in order to 
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V. Implementing (and 
Reimplementing) Effective, 
StreamUned Control 
Procedures 

Transforming a department's or institution's control structures cannot be a one-time, 
fragmented effort. An effective sy stemrequires the continual rethinking of entire processes and policies, 
on an all-inclusive basis. 

' Improvement efforts cannot focus simply on the control structures; it is a must to consider the 
entire process. Therefore, when groups work to redesign control structures, they are actually redefining 
the way in which they conduct business: the processes and policies. 

The process for change follows the basic rules for streamlining that were outlined in the 
introductory section of this monograph. As discussed, process redesign initiatives include four 
fundamental steps, or phases: baseline, planning, pilot/implementation, and continuous improvement. 
This paradigm for cost-effective control in no way changes the focus of streamlining efforts on cost, 
customer service, and quality. However, there is a new ingredient: managers must customize the 
streamlining process to introduce the dimension of ensuring adequate control. For improvements in 
financial areas, administrators must defme the critical success factors (defined in the "vision" of the 
planning phase) so that quality is interpreted as effectively meeting the control objectives previously 
outlined in Sections II and III. These control objectives consist of safeguarding assets, encouraging 
adherence to managerial policies, generating reliable financial transactions and information, and 
promoting operational efficiency. 

In each of the four phases, several factors will focus the improvement team so that their efforts 
will lead to both adequate control and operational efficiency. In this section, the authors outline the 
critical factors that the team must address while desifxning and implementing new control structures in 
financial areas. For each of the four fundamental steps, the basic tenets for streamlining efforts are 
summarized. Foil owing this is a list of critical question s within each phase that can help an improvement 
team evaluate their efficiency ideas with respect to financial control. 



Baseline Phase 

Once a particular area has been targeted for improvement, the baseline phase usually focuses 
on documenting and ''measuring" the current process(es). Quantifying the process(es) helps the entire 
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team to understand exactly how the current system works and to objectively highlight bottlenecks or 
opportunities for improvement. Measurements v/ould include statistics such as forms processed per 
minute, transaction turnaround time, or processing cost per transaction. This focus on measurement 
and administrative efficiency may first seem only remotely related to improving control structures. 
However, this type of a baseline assessment supports the redesign of the entire transaction process. To 
gain efficiency, planners must develop an objective assessment of the entire process, both from an 
operational and a control perspective. These types of measurements and the basic objectives of the 
baseline phase are absolutely critical for truly "breakthrough" improvements. 

To incorporate concerns about control, it is essential to develop the baseline assessment of the 
control functions in the current process(es). The various controls in the current system do serve specific 
purposes. Before simply eliminating unnecessary steps, the improvement team must identify what the 
control needs were in the old process and then use these as a foundation to ensure that customers ' control 
needs are still met. The following questions can help address these issues: 

■ Wliat are the business, financial, and accounting risks inherent in the area under review? 

■ Why does each particular control exist in the current process? Whether it is an additional 
approval, an extra divis ion in labor, or any other kind of control, what exactly is the control ' s 
purpose? 

■ Is this particular control addressing a specific risk or simply controlling transaction 
processing? 

■ Does the control link accountability to authority and responsibility for the financial 
transaction or process? 

■ Does the control impede customer service? If so, is this loss in service justified by the 
corresponding level of financial risk that must be controlled? 

■ Is the control unique, or redundant? 

■ If the output of a process is areport, how is each report used? Often, controls exist to ensure 
the integrity of data, and the data are then shared with "everyone" via a series of reports. 
Are the reports truly necessary? How exactly are the data used in the current environment? 
Does the institution need to generate these data in the first place? 



Planning Phase 

In the planning phase, the team identifies customer needs (both operational and control needs; 
both internal and external customers), compares them to the baseline of the current process^ and then 
evaluates the gaps between customer needs and current process outputs. A key objective of this phase 
is to plan improvements to close any gaps and to meet customer expectations. Once again, the team can 
ensure control issues are sufficiently addressed in these plans by considering questions such as the 
following: 
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■ What level or type of control is necessary to manage financial risk? What is it that the 
customers want controlled? How sensitive is the institution to the business, financial, and 
accounting risks inherent in the area under review? 

■ Does the redesigned control structure still meet the purposes and objectives of traditional 
control structures after adapting new processes to the modem business environment? For 
instance, does the accounting system still meet the criteria identified in figure 3? For high- 
risk transactions, does the institution still segregate duties where necessary, require upper- 
level authorizations, or conduct random audits to ensure adequate control? 

■ Does the plan address the costs and benefits of implementing specific control elements? 
Is the control not only necessary but also financially prudent? 

" Is additional control justified because of unusually large revenue streams or other risk 
factors? Are there other factors that could justify additional controls, such as the risk of 
exposure to bad publicity or the risk of jeopardizing a particularly large alumni donation? 

■ Does the plan truly take advantage of the capabilities of technology? Could an alternate 
approach eliminate whole segments of processes and controls by relying on in-process edits 
and checks? When a control inserts manual intervention into a process, is it really necessary? 
How may the institution more effectively integrate different computer systems to eliminate 
the need for duplicate work or controls? 

■ ArejiU key customers included in the process? Is management meeting the control needs 
of €ach customer? 

These questions can be used as tools not only for ensuring adequate control but also for pushing 
efficiency efforts higher by questioning the need for certain controls and eliminating unnecessary ones. 
Questions such as these should help the team define control needs and then rigorously challenge old 
ways of doing business, breaking out of fossilized, established "routines." 



Pilot/Implementation Phase 

This phase proceeds in two parts. First a "trial" area is selected for implementation, and plans 
are tested. Once the quirks are worked out of the process, implementation moves into other areas. The 
idea is to leam from experience in a test area (or two) before uprooting the entire system. 

Certainly, this phase is critical for testing changes in control structures. As unnecessary 
controls and redundant back-up systems are eliminated, changes are sure to backfire once in a while. 
Effective communication becomes pivotal as control issues are tested and negotiated. Group meetings 
of key players should specifically address any lapses in control and options for any necessary back-up 
systems. As lapses in control occur, the group should consider the following questions, and then refer 
back to questions in the baselining and planning phases to develop solutions. 

■ Why exactly did the lapse in control occur? 

■ Is the lapse significant? Does the incident justify change or does it fall within the 
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boundaries of the cost-benefit analysis? Can the institution afford another incident similar 
to this one? 

■ With what specific control issue is the customer-who received the service and presumably 
identified the lapse in control-concerned? What other options does the institution have to 
attempt to satisfy this customer's need for a particular type of information or control? 

■ Have the results in the pilot area been thoroughly examined? Has the team verified that 
the customer's control needs have actually been met? 



Continuous Improvement 

Continuous improvement asks that the work group constantly reevaluate the business 
environment and adapt its processes to meet changing customer needs. Particularly in financial areas, 
an external factor will often influence the department's activities. For instance, a new regulation or a 
different senior administrator might require that new or different information be maintained by the 
department. 

Rather than simply layering on another task or control, the process should be reevaluated to 
meet the new demands. As invoked in Excellence in Government: Total Quality Management in the 
1990s, "Go back to assessment ^sid planning, introduce higher levels of TQM, and continue to build 
your capabilities. [Improvement is] a journey not a destination."'^ 

When facing new requests for control or for information, go back to the same critical questions 
identified in the baselining and planning phases. 

The overall goal is to prevent the layering on of controls, a process that has become all too 
common over the past few decades. Institutions can no longer afford the luxury of being over-controlled. 
Figuring out what is really needed to manage exposure to risk and meet customer expectations is a 
continuous process with the clear rewards of elimination of extra or meaningless controls (as well as 
extra work!), and ongoing assurance of the appropriateness of the control structure. 



VL Conclusions 



With so much attention focused on the twin goals of efficiency and effectiveness over the past 
few years, it is ironic that so little study has been directed to the efficiency of control structures. The 
nature of controls has changed only slightly over the course of several decades. One of the subtleties 
in designing a new model for control is that the fundamental theories of control are, in fact, constant — 
higher education, like all business, employs control systems to manage exposure to unintended 
business, financial, and accounting risks. Higher education still has the same control purposes and 
objectives that it did half a century ago. 

However, if implementation is separated from the theoretical framevv'ork of the purposes of 
control structures, then one may see radical change, and it is in the implementation of control objectives 
whereanew model is desperately needed in modem higher education administration. In this monograph, 
the authors have applied the theoretical framework of traditional control structures to a new business 
environment and to an evolving processing environment The following driving forces in each of these 
two arenas give shape to the new model: 

■ Business operations must be flexible, agile, and service oriented 

" Processing systems must leverage the full capabilities of modem technology and a more 
educated, capable, and empowered workforce 

These factors lead to a remarkable shift in the theoretical framework of the implementation of 
controls. In keeping with the philosophy of the new system, management should no longer attempt to 
control processes but should focus on controlling exposure to risk. Doing this places new demands on 
managers to reevaluate and quantify both the risk inherent in a certain process and the overall risk 
sensitivity within the institution. 

Controls that are part of the process, rather than being external oversight at the end of a process, 
can still provide fully appropriate levels of control. Controls can now be designed to "channel" 
transactions through differing levels of scrutiny based on risk. In the past, managers depended on 
"gates" placed throughout a cycle, interrupting the flow for manual intervention. Processes no longer 
have to be controlled by omnipresent "yes or no" checks. With technology and cost-benefit analyses, 
planners can choose to use varying levels of control and to take calculated risks. 

Finally, will controls designed for a streamlined environment still pass muster in the annual 
audit? If such controls are designed to meet the traditional purposes and objectives, and if they meet 
the institution's customer and environmental needs, the answer is a resounding "yes." 
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